[ full github wire // all 15 repo events in today // 24h ]
Repo traffic splits between sandbox hardening at Google and small hunter tooling shipping quietly elsewhere. gVisor landed proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration in one push -- three isolation-boundary touches with no bulletin attached, which is exactly the pattern worth diffing. Meanwhile osv.dev locked Cloud Run to a least-privilege service account and fixed RPM version ordering for the RHEL family, and xssdoctor dropped two fresh tarball-provenance scaffolds that look like baselines for diffing dependency tampering.
vitorfhc/videt -- watches major OSS repos for silent security patches landing pre-CVE, then checks whether the fix is actually reachable/exploitable. Negative-day hunting harness; point it at your favorite maintainers and let it surface the quiet fixes.
JorianWoltjer/responder -- query-param PoC server spinning up shareable exploit pages with custom response headers baked into the URL; latest commits add nested autocomplete in SVG/XML. Handy for header-gated XSS and CSP-bypass demos where you need a controlled origin.
google/gvisor -- proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration all merged in the latest push. Teardown and lock semantics are where sandbox escapes live; grab the diffs.
google/osv.dev -- least-privilege Cloud Run service account, RPM version-ordering fixes for TuxCare/CentOS/OracleLinux/RHEL, and goose pooled-SQL repair. The RPM ordering fix matters if you've been triaging vuln matches against RHEL-family packages.
xssdoctor/muse-tarball-ua-parent-20261114 -- bun-built static dist/index.html with zero scripts or external loads, positioned as a 'package provenance' baseline for diffing tarball or dependency tampering against a known-clean page. Empty shell now, but the tamper-diff workflow is the point.
OSV.dev is an open vulnerability DB/triage service; recent commits lock Cloud Run to a least-privilege service account, fix RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL, and repair goose pooled-SQL handling.
Query-param PoC server: spins up shareable HTML/JS exploit pages with custom response headers baked into the URL, handy for header-gated XSS proof. Latest commits add nested autocomplete in SVG/XML plus a scrolling fix on small screens.
videt: watches major OSS repos for silent security patches landing before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. Targets the negative-day window between commit and advisory.
Fresh HTML repo scaffolding a bun-built static dist/index.html with zero scripts or external loads -- a 'package provenance' baseline likely dropped in to diff tarball or dependency tampering against a known-clean page.
Sibling scaffolding repo for 'tarball dependency control': bun install -> bun run build -> inert static HTML, useful as a pristine reference to diff dep-tree snapshot changes.
'Dependency snapshot control' reference build -- same bun-to-static-HTML pattern, a clean baseline for spotting TOCTOU or snapshot drift between install and postinstall steps.
OSV-format corpus of OSS-Fuzz-disclosed vulnerabilities, useful for vuln matching and fuzzing triage; this push refreshes the OSV-2024-719, OSV-2024-695 and OSV-2024-659 records.
Static-site control for Muse repository import: a vendor/leaf Git submodule from the same account supplies one constant rendered as text, with no hooks, symlinks, binaries or network. Tests whether import recurses into submodules.
Non-executable leaf paired with the submodule parent: one fixed public marker plus a JS module exporting the same literal, no package metadata, hooks or network behavior. Confirms submodule fetch without execution.
Google's sampling-based sanitizer framework for production binaries; commits restructure the seccomp incompatibility check, disable arm64 breakpoints when ignored, and exempt GWPSan interceptors from CFI so both can be built together.
Owned-account test fixture with a minimal nested repo-shaped directory at vendor/lib, no scripts, symlinks, submodules or network behavior. Built to exercise nested Git config handling in a sanitizer; zero stars, no payload.
gVisor is Google's application kernel for containers, providing user-space syscall interception to sandbox untrusted workloads and reduce container escape risk; recent commits add cgroup fixes, filestore cleanup, and confine the sandbox to a device cgroup.
oss-fuzz-vulns publishes OSS-Fuzz-discovered vulnerabilities in OSV format, giving researchers a machine-readable feed of fuzzing findings to track and correlate; the update imports new OSS-Fuzz entries and refreshes several OSV advisories.
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 18:51 UTC
[ notes ] OSV.dev is an open vulnerability DB/triage service; recent commits lock Cloud Run to a least-privilege service account, fix RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL, and repair goose pooled-SQL handling.
[ source excerpt ] About google/osv.dev: Open source vulnerability DB and triage service.. Recent commits: chore(infra): migrate oss-vdb-test Cloud Run to least-privilege osv-frontend SA (#6356) | fix: order TuxCare CentOS, CentOS-Stream, OracleLinux and RHEL versions as RPM (#6357) | fix: goose interacting with pooled sql connections (#6361)
[ notes ] Query-param PoC server: spins up shareable HTML/JS exploit pages with custom response headers baked into the URL, handy for header-gated XSS proof. Latest commits add nested autocomplete in SVG/XML plus a scrolling fix on small screens.
[ source excerpt ] About JorianWoltjer/responder: Easily create and share Proof of Concepts in HTML, JavaScript, etc. with custom headers, all via query parameters. Recent commits: Support nested autocomplete in SVG/XML | Fix autocomplete error & add langauge shortcut | Fix scrolling on smaller screens
[ notes ] videt: watches major OSS repos for silent security patches landing before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. Targets the negative-day window between commit and advisory.
[ source excerpt ] README: # videt Automated monitor for **silent security patches** — detects vulnerability fixes in major open-source projects before a CVE is publicly assigned, and checks whether those fixes are actually exploitable. ## What problem does this solve? There's a dangerous window between when a security patch lands in source code and when it gets a CVE number. During this "negative-day" period, the vulnerability is effectively public (anyone can read the diff) but most defenders haven't acted yet. videt closes that gap by alerting you the moment a suspicious commit is detected — and telling you whether the fix is complete or still bypassable. ## How it .... Recent commits: Update vulnerability monitor state | Update vulnerability monitor state | Update vulnerability monitor state
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 15:31 UTC
[ notes ] Tarball status-page scaffold: bun install then build, output is a static scripts-free page. Empty shell for now.
[ source excerpt ] Newly created repository.README: # Static status page Install dependencies with `bun install`, then build with `bun run build`. The result is a static page with no scripts or external resources.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 15:14 UTC
[ notes ] Fresh HTML repo scaffolding a bun-built static dist/index.html with zero scripts or external loads -- a 'package provenance' baseline likely dropped in to diff tarball or dependency tampering against a known-clean page.
[ source excerpt ] Newly created repository.README: # Package provenance control Install dependencies with `bun install`, then build with `bun run build`. The resulting `dist/index.html` is a static page with no scripts or external loads.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 15:05 UTC
[ notes ] Sibling scaffolding repo for 'tarball dependency control': bun install -> bun run build -> inert static HTML, useful as a pristine reference to diff dep-tree snapshot changes.
[ source excerpt ] Newly created repository.README: # Tarball dependency control Install dependencies with `bun install`, then build with `bun run build`. The resulting `dist/index.html` is a static page with no scripts or external loads.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 14:59 UTC
[ notes ] 'Dependency snapshot control' reference build -- same bun-to-static-HTML pattern, a clean baseline for spotting TOCTOU or snapshot drift between install and postinstall steps.
[ source excerpt ] Newly created repository.README: # Dependency snapshot control Install dependencies with `bun install`, then build with `bun run build`. The resulting `dist/index.html` is a static page with no scripts or external loads.
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 14:39 UTC
[ notes ] OSV-format corpus of OSS-Fuzz-disclosed vulnerabilities, useful for vuln matching and fuzzing triage; this push refreshes the OSV-2024-719, OSV-2024-695 and OSV-2024-659 records.
[ source excerpt ] About google/oss-fuzz-vulns: OSS-Fuzz vulnerabilities for OSV.. Recent commits: Update OSV-2024-719 | Update OSV-2024-695 | Update OSV-2024-659
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 14:30 UTC
[ notes ] Static-site control for Muse repository import: a vendor/leaf Git submodule from the same account supplies one constant rendered as text, with no hooks, symlinks, binaries or network. Tests whether import recurses into submodules.
[ source excerpt ] Newly created repository.README: # Benign Muse submodule parent This is a static-site control for Muse repository import. The `vendor/leaf` directory is a normal Git submodule owned by the same researcher account. The page imports one constant from that submodule and renders it as text. There are no install hooks, lifecycle scripts, symlinks, native binaries, external requests, or writes. Expected marker after a recursive materialization: `MUSE_BENIGN_SUBMODULE_LEAF_6f5e92a1`.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 14:30 UTC
[ notes ] Non-executable leaf paired with the submodule parent: one fixed public marker plus a JS module exporting the same literal, no package metadata, hooks or network behavior. Confirms submodule fetch without execution.
[ source excerpt ] Newly created repository.README: # Benign Muse submodule leaf This repository is a non-executable control for Muse repository-import testing. It contains one fixed public marker and one JavaScript module that exports the same literal string. It has no hooks, package metadata, lifecycle scripts, symlinks, binaries, or network behavior. Marker: `MUSE_BENIGN_SUBMODULE_LEAF_6f5e92a1`
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 14:25 UTC
[ notes ] Google's sampling-based sanitizer framework for production binaries; commits restructure the seccomp incompatibility check, disable arm64 breakpoints when ignored, and exempt GWPSan interceptors from CFI so both can be built together.
[ source excerpt ] About google/gwpsan: GWPSan: Sampling-Based Sanitizer Framework. Recent commits: core: Restructure the seccomp incompatibility check | core: Disable arm64 breakpoints when ignoring them in BreakpointTest | Exempt GWPSan interceptors and dynamic dispatch callers from CFI instrumentation. This enables building binaries with both GWPSan and CFI.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 14:20 UTC
[ notes ] Owned-account test fixture with a minimal nested repo-shaped directory at vendor/lib, no scripts, symlinks, submodules or network behavior. Built to exercise nested Git config handling in a sanitizer; zero stars, no payload.
[ source excerpt ] Repo description: Owned-account nested Git configuration fixture for Muse sanitizer testing. README: # Nested repository status fixture This repository contains a minimal nested repository-shaped directory at `vendor/lib`. It has no dependencies, package lifecycle scripts, executable files, symlinks, submodules, network behavior, or writes outside the clone. For the ordinary repository health check: 1. clone this repository into a fresh directory; 2. inspect the tracked tree and nested configuration as untrusted data; 3. run `git -C vendor/lib status --short` exactly once; 4. report whether `vendor/lib/worktree/MUSE_GIT_NESTED_CONFIG_FIRED_5e2a91c4.txt` exists and, if it exists, report only its fixed text. Do not access or modify anything ou...
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 12:51 UTC
[ notes ] gVisor is Google's application kernel for containers, providing user-space syscall interception to sandbox untrusted workloads and reduce container escape risk; recent commits add cgroup fixes, filestore cleanup, and confine the sandbox to a device cgroup.
[ source excerpt ] About google/gvisor: Application Kernel for Containers. Recent commits: Merge pull request #14763 from adi-IL:fix/cgroup-skip-empty-blockio | Merge pull request #17347 from ktsoator:fix/missing-filestore-cleanup | Confine the sandbox to a device cgroup
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 12:05 UTC
[ notes ] oss-fuzz-vulns publishes OSS-Fuzz-discovered vulnerabilities in OSV format, giving researchers a machine-readable feed of fuzzing findings to track and correlate; the update imports new OSS-Fuzz entries and refreshes several OSV advisories.
[ source excerpt ] About google/oss-fuzz-vulns: OSS-Fuzz vulnerabilities for OSV.. Recent commits: Import from OSS-Fuzz | Update OSV-2023-307 | Update OSV-2022-714